Trezor, the hardware crypto wallet maker, disclosed that attackers compromised one of its email service providers, exposing customer email addresses to scammers. The breach marks the second time in recent months that a third-party vendor serving Trezor has suffered a security incident.
The company confirmed that hundreds of thousands of Trezor users had their email addresses leaked in the breach. The exposed data created an immediate threat surface for phishing campaigns targeting crypto holders. Scammers have already begun leveraging the email list to impersonate Trezor and trick users into surrendering private keys or seed phrases, the master passwords that unlock crypto wallets.
Trezor acknowledged the breach in a public statement but emphasized that the hardware wallets themselves remained secure. The compromised data did not include passwords, private keys, or wallet recovery seeds. However, the email addresses alone provided attackers with a list of confirmed cryptocurrency owners, making the list highly valuable for targeted social engineering campaigns.
The incident exposes a structural weakness in Trezor's supply chain security. The company relies on external vendors for critical customer communications, and those vendors have become targets for sophisticated threat actors hunting for crypto-related data. A breach at a Trezor shipping partner earlier this year already compromised customer names, addresses, and phone numbers, creating multiple vectors for scammers to contact users.
Trezor users received warnings about the phishing risk and guidance on how to identify fraudulent communications. The company advised customers never to share seed phrases or private keys, even with Trezor support staff. Legitimate Trezor communications always come through official channels and never request sensitive account information.
The breach underscores broader security challenges facing hardware wallet makers. While the devices themselves use cryptographic protections that remain extremely difficult to break, the customer ecosystem around them presents vulnerabilities. Email lists, shipping addresses, and phone numbers all become targets for attackers seeking entry points into crypto wallets.
Trezor has not disclosed the specific email provider that was breached or provided a timeline for when the compromise occurred. The company stated it was working with the affected vendor to understand the full scope of the incident and implement additional safeguards.
For Trezor users, the immediate action involves heightened vigilance around unsolicited communications claiming to come from the company. Phishing campaigns typically attempt to create urgency through fake security alerts or account suspension warnings designed to pressure users into quick actions that bypass normal verification steps.
The incident reflects a broader pattern in the crypto industry where third-party vendors have become attractive targets for attackers. As hardware wallet adoption grows and customer bases expand, the operational infrastructure supporting these companies becomes increasingly complex and harder to secure. Each vendor represents a potential weak link in the chain protecting millions of dollars in customer assets.